Research map / Image generation / Text-to-image diffusion
Implicit Bias Injection Attacks against Text-to-Image Diffusion Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IBI-Attacks, a training-free-at-inference, plug-and-play attack that injects implicit (emotional, cultural, religious) bias into T2I diffusion models by adding an adaptively scaled mean bias direction in the prompt embedding space.
Problem
Biased text-to-image models can be deliberately exploited to inject subtle, hard-to-detect implicit biases (e.g., emotional tone) that influence public perception, whereas prior work targets only explicit visual biases and often requires fine-tuning.
Approach
Compute a mean difference vector between LLM-generated neutral and adjective-biased prompt text embeddings, then use a SENet-inspired attention module conditioned on the user prompt embedding to dynamically scale this direction before adding it to the prompt embedding, so the model is biased without changing prompts or retraining the diffusion model.
Key results
- Negative bias injection raises the 'more negative' rate from 14.4% (original) to 80.2% with IBI, versus 89.1% for explicit prompt modification, which degrades image quality more (SSIM 0.5221 vs 0.6987).
- In a 24-person human study, 35.8% of IBI images were picked as abnormal, nearly equal to 35.7% for original images, versus 57.5% for explicit prompt modification.
- Zero-shot transfer of the human-scene module reaches 95.1% negative on animal scenes and 89.2% negative on nature scenes.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add adaptive feature selection to the average bias direction (ablation) | IBI · COCO human captions, negative bias | More negative rate: 82.2% -> 80.2% | Hurt |
| Add adaptive feature selection to the average bias direction (ablation) | IBI · COCO human captions, negative bias | CLIPimg-img: 0.8143 -> 0.8793 | Helped |
| Add adaptive feature selection to the average bias direction (ablation) | IBI · COCO human captions, positive bias | More positive rate: 85% -> 83.7% | Hurt |
| Add adaptive feature selection to the average bias direction (ablation) | IBI · COCO human captions, positive bias | CLIPimg-img: 0.8030 -> 0.8247 | Helped |
| Transfer the negative-bias module trained on human scenes to animal scenes | IBI · Animal scenes | Negative rate: 9.2% -> 95.1% | Helped |
| Transfer the negative-bias module trained on human scenes to nature scenes | IBI · Nature scenes | Negative rate: 8.1% -> 89.2% | Helped |
| Inject negative bias using IBI | Stable Diffusion-3 · Negative-bias evaluation | Negative rate: 12.4% -> 68.2% | Helped |
| Inject negative bias using IBI | FLUX-schnell · Negative-bias evaluation | Negative rate: 8.0% -> 65.4% | Helped |
| Inject negative bias using IBI | MUSE · Negative-bias evaluation | Negative rate: 10.8% -> 91.2% | Helped |
| Use adjective-only LLM rewriting to calculate the bias direction instead of unrestricted rewriting (ablation) | IBI bias-vector generation · Bias injection | Image semantic preservation | Helped |
| Apply debiasing methods to IBI | IBI · Negative-bias evaluation | Negative rate: 80.2% -> 78.2%; 80.2% -> 79.6% | No clear effect |
Surprising findings
- A single mean bias direction already injects bias without any input-dependent adaptation, but applying it uniformly degrades image quality (IBI w/o adaptive module).
- Word-level debiasing methods (Chuang et al., Kim et al.) provide little defense against sentence-level implicit bias injection.
Limitations
- Main evaluation focuses on emotion (sentiment) bias; cultural and religious bias are shown only qualitatively in a figure.
- Judgment of bias relies mainly on an MLLM (LLaVA) and a small human study of 24 participants.
- Training data is LLM-generated from a single model (ChatGPT-4) with restricted adjective-only rewriting.
Experimental setup
Datasets: COCO LLM-generated neutral and biased prompts
Benchmarks: COCO captions (1,000 human-related test captions)
Metrics: bias success rate (MLLM-judged negative/positive) CLIP text-image score CLIP image-image score SSIM FID PickScore human study abnormal and injection rates
Baselines: Explicit prompt modification IBI w/o adaptive module Chuang et al. debiasing Kim et al. debiasing
Builds on: SENet Backdooring Bias
Closest papers by meaning
- FairImagen: Post-Processing for Bias Mitigation in Text-to-Image Models (NeurIPS 2025 · similarity 0.88)
- Finetuning Text-to-Image Diffusion Models for Fairness (ICLR 2024 · similarity 0.88)
- Rethinking Training for De-biasing Text-to-Image Generation: Unlocking the Potential of Stable Diffusion (CVPR 2025 · similarity 0.88)
- Position: Towards Implicit Prompt For Text-To-Image Models (ICML 2024 · similarity 0.88)
- Fair Text-to-Image Diffusion via Fair Mapping (AAAI 2025 · similarity 0.87)
- T2ISafety: Benchmark for Assessing Fairness, Toxicity, and Privacy in Image Generation (CVPR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.